iCONIC 2026 | From Assets to Adversaries: Building a Pen Testing Program

Multi-factor authentication (MFA) is a vital line of defence against account and identity compromise, but not all types of MFA protect against phishing. During this hands-on and controlled demo, penetration tester / ethical hacker Kurt Pomeroy will reveal how hackers utilize adversary-in-the-middle phishing to hijack a Microsoft 365 logon, steal the MFA-verified session, and gain access to the account (without knowing the password). Audience members will get to experience the attack from both the target’s and hacker’s viewpoints, learn about the warning signs, and walk away with practical tips on how to safeguard their organization using phishing-resistant authentication. No technical background is necessary.